57
Threat Brief: OWASSRF Vulnerability Exploitation
Unit 42 details active exploitation of Exchange SSRF flaws CVE-2022-41080/CVE-2022-41082 via the OWASSRF method, deploying the SilverArrow PowerShell backdoor.
Unit 42 documents OWASSRF, an exploit chain combining CVE-2022-41080 and CVE-2022-41082 to achieve remote code execution on Microsoft Exchange via Outlook Web Access, bypassing Microsoft's ProxyNotShell mitigations. Active exploitation was observed in late November and early December 2022, affecting at least eight organizations. Attackers authenticated to Exchange, then executed a PowerShell backdoor tracked as SilverArrow to create admin accounts, install AnyDesk, tunnel RDP via PuTTY Link, and dump LSASS memory for credential theft. Exploitation is isolated rather than mass-scale because authentication is required.
55
57
60
57
New ‘ShieldCrash’ Zero-Day Exploit Targets Microsoft Defender
Researcher Nightmare Eclipse released ShieldCrash, a Microsoft Defender zero-day PoC bypassing ShieldBreak patches to gain System privileges on Windows.
The researcher known as Nightmare Eclipse released a PoC zero-day exploit dubbed ShieldCrash against Microsoft Defender on fully patched Windows systems. The exploit grants arbitrary file read with System privileges and can be used to drop the SAM database. It bypasses Microsoft's September 3 fixes for ShieldBreak (CVE-2026-69414), which itself bypassed patches for the RoguePlanet race condition (CVE-2026-50656). Microsoft has been contacted for comment and has not yet responded.
65
Microsoft Shatters Patch Tuesday Record With 974 CVE Fixes in September 2026
Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited Windows zero-days, CVE-2026-85880 and CVE-2026-81963.
Microsoft fixed a record 974 CVEs in its September 2026 Patch Tuesday, surpassing the previous record of 570 in July 2026, with Windows affected by 723 flaws and Office by 111, including 119 critical vulnerabilities. Two zero-days are actively exploited: CVE-2026-85880, a 7.8 heap-based buffer overflow in Windows ALPC allowing AppContainer privilege escalation, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack enabling local privilege escalation. Microsoft attributed the update surge partly to agentic AI tools used to discover zero-day vulnerabilities, and researchers highlighted critical RCE flaws in Windows DNS, DHCP and Deployment Services as priorities.
78
Windows Defender ShieldCrash 0-Day Lets Attackers Read Arbitrary Files as SYSTEM
Unpatched Windows Defender zero-day 'ShieldCrash' PoC lets local attackers read arbitrary files as SYSTEM, apparently bypassing the CVE-2026-69414 patch.
Researcher MSNightmare published a skeleton proof-of-concept for 'ShieldCrash', an unpatched Microsoft Defender flaw enabling arbitrary file reads with SYSTEM privileges that reportedly persists on supported Windows versions after September 2026 updates. It appears to bypass the recent fix for the Malware Protection Engine elevation-of-privilege flaw CVE-2026-69414 (ShieldBreak), patched in engine version 1.1.26080.3. SYSTEM-level file disclosure could expose credentials, application secrets and registry hives and support post-compromise reconnaissance. No active exploitation is confirmed and Microsoft had issued no specific patch or mitigation at disclosure time.
60
Magento StyleSmuggler zero-day exploited to deploy Linux backdoor
StyleSmuggler zero-day in Magento and Adobe Commerce is actively exploited in the wild to deploy a Rust-based Linux backdoor; fix not yet released.
A zero-day dubbed StyleSmuggler affecting all versions of Magento and Adobe Commerce is being actively exploited, with the first observed incident on September 4 on a fully patched site. The exploit injects PHP code via Magento's template system through a fake 'failed-payment' email to achieve code execution, installing a Rust-based backdoor disguised as kworker/u:8:0 or fc-cache with a 30-minute cron job for persistence. The backdoor communicates via TLS/WebSockets or UDP port 123 masquerading as NTP traffic, checks TracerPid to detect tracing, and can receive remote commands. Adobe confirmed it is working on a fix with no timeline; Sansec recommends disabling GraphQL as mitigation and monitoring for suspicious cron entries and kworker or fc-cache processes. Magento is installed on more than 160,000 websites, including 14,000 of the top 1 million sites.
78
Hackers drain $320M in Bitcoin from Liquid Network, claim they're the good guys
Attackers withdrew about 4,000 BTC (~$320M) from Liquid Network's federation wallet via a SideSwap peg-out, claiming whitehat status.
Hackers drained roughly $320 million in Bitcoin — about 4,000 BTC, 95% of holdings — from the federation wallet backing Blockstream's Liquid Network sidechain. The withdrawal occurred through SideSwap using its Peg-out Authorization Key (PAK), yet no PAK appears to have been compromised, and the exact mechanism remains under investigation. The actors embedded an on-chain message identifying themselves as whitehats, asked Blockstream to patch federation nodes first, and promised to return most of the funds after fixes are confirmed. Liquid disabled its bridge nodes and asked exchanges to suspend L-BTC deposits and withdrawals; other Liquid assets and the Bitcoin network were unaffected.
78
Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits
Researcher Nightmare Eclipse released working zero-day PoCs for Avast, CrowdStrike Falcon, and Nvidia, prompting a Gen patch, CrowdStrike mitigation, and Nvidia investigation.
Security researcher Nightmare Eclipse released three zero-day exploits within a short window: PrettyPrague targeting the Avast sandbox for full system privileges (possibly affecting other GenDigital products including AVG and Norton), FalconFlank exploiting CrowdStrike Falcon Sensor's Office malicious macros remediation feature for privilege escalation, and GreenSection targeting an out-of-bounds memory write in a shared global memory section used by Nvidia user-mode components. GenDigital said it has fixed the Avast issue; CrowdStrike advised disabling the Microsoft Office File Suspicious Macro Removal policy setting; Nvidia said it is actively investigating the PoC. Kevin Beaumont reported that the Avast, CrowdStrike, and Kaspersky exploits work. The researcher previously released the HardBreacher privilege escalation zero-day in Kaspersky endpoint security, patched August 31.
62
Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released
TantoSec published a working exploit chaining a Telerik UI padding oracle to unauthenticated RCE; Progress patched the flaws in July.
TantoSec's Marcio Almeida released a full exploit chain and tooling for the RadAsyncUpload control in Telerik UI for ASP.NET AJAX, turning a padding oracle (CVE-2026-13182) into unauthenticated RCE via an unguarded type-resolution flaw (CVE-2026-13181, CVSS 8.1). Exploitation requires a rendered RadAsyncUpload handler and an explicit non-default encryption key, and took roughly 127,000 oracle requests (about an hour) in lab testing. Versions 2010.1.309 through 2026.2.519 are affected; Progress fixed the chain in 2026.2.708 on July 8, 2026, and no in-the-wild exploitation has been confirmed. A separate RCE chain in RadPersistenceManager and RadDockLayout (CVE-2026-13185, -13186, -13190) was also patched but has no public exploit.
60
BGP hijack infecting networks caused by a comedy of errors that’s not funny at all
Attackers BGP-hijacked Softaculous IP space via Hetzner routing lapses to push malicious Virtualizor updates to hosting servers.
Unknown attackers hijacked the 162.55.80.0/24 prefix used by Softaculous' Virtualizor update service by abusing lax routing security at hosting provider Hetzner Online, announcing the range through AS6204, AS62390, and AS24940 with a forged but RPKI-valid origin. The hijack pulsed intermittently over roughly 33 hours, delivering modified update packages to Virtualizor servers, which lacked cryptographic code signing for updates. Softaculous says only a small number of servers were likely affected but cannot produce a definitive list, urging administrators to treat every Virtualizor server as in scope for checks.
65
CISA Warns Water Utilities: Find Your Exposed PLCs Before Attackers Do
CISA urged water utilities to secure internet-exposed PLCs after July 2026 attacks compromised over 100 US water and wastewater systems, suspected Iran-linked.
CISA's exposure-reduction guidance, published August 21, follows July 2026 attacks in which threat actors remotely accessed PLCs connected directly through cellular modems, changed device IP addresses and passwords, and in some cases disabled alarms and shutdown processes without notifying operators. Iran is the suspected actor, though officials stopped short of formal attribution. CISA recommends routing remote access through centrally managed secure gateways, phishing-resistant MFA, unique credentials, and external scanning of industrial protocols such as Modbus, EtherNet/IP, DNP3, BACnet and OPC UA.
72
57
60
57
60
57
60
60
60
60
57
57
57
60
60
57
57
57
57
60